check point required

Hi all, Quick question how can I find what a user was doing (apart from onstat -u) to cause a delay in my check point. I have check point every 5 mins, I had an instance were it took 1300 seconds to run. I know one of my users was running a sql and I believe it created a cartesean product but I would like to see what exactly he was doing, Is there a way to see this. It was not a report or a program he was running, it was through (isql dbname). Thx for all the help Marco